Analysis
-
max time kernel
114s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 19:06
Static task
static1
Behavioral task
behavioral1
Sample
C1619D951B039CE9CB600815E8B14B26.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
C1619D951B039CE9CB600815E8B14B26.exe
Resource
win10v2004-20240802-en
General
-
Target
C1619D951B039CE9CB600815E8B14B26.exe
-
Size
1007KB
-
MD5
c1619d951b039ce9cb600815e8b14b26
-
SHA1
4def66d57b972beb3065a29ed1fe88610943d383
-
SHA256
e9837fc1d609e0084452590c09746a89af73ec6abf45a26ab58a4d48c9ebceac
-
SHA512
c1f071ab1cbe2e12576227a69618f2a717d49c6fa632280b2d769c53c1c8d89bfe51bd524f5aed13fb67d84109e4aa99ec05d96a589284f275135f036bdb2edc
-
SSDEEP
24576:heAy4u8ZernsYvWwUIGOh5rE1xrJK06WwkS9Ev95FZCyGWsfe:Iyern6VIVqxrJ5KyvVZCyGWsfe
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral2/memory/4168-1055-0x00000000052C0000-0x00000000052DA000-memory.dmp family_asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation C1619D951B039CE9CB600815E8B14B26.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kzaibmgvot = "C:\\Users\\Admin\\AppData\\Roaming\\Kzaibmgvot.exe" C1619D951B039CE9CB600815E8B14B26.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_compiler.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1619D951B039CE9CB600815E8B14B26.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 2968 timeout.exe 2624 timeout.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4696 C1619D951B039CE9CB600815E8B14B26.exe Token: SeDebugPrivilege 4696 C1619D951B039CE9CB600815E8B14B26.exe Token: SeDebugPrivilege 4168 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4696 wrote to memory of 4832 4696 C1619D951B039CE9CB600815E8B14B26.exe 91 PID 4696 wrote to memory of 4832 4696 C1619D951B039CE9CB600815E8B14B26.exe 91 PID 4696 wrote to memory of 4832 4696 C1619D951B039CE9CB600815E8B14B26.exe 91 PID 4832 wrote to memory of 2968 4832 cmd.exe 93 PID 4832 wrote to memory of 2968 4832 cmd.exe 93 PID 4832 wrote to memory of 2968 4832 cmd.exe 93 PID 4696 wrote to memory of 1844 4696 C1619D951B039CE9CB600815E8B14B26.exe 95 PID 4696 wrote to memory of 1844 4696 C1619D951B039CE9CB600815E8B14B26.exe 95 PID 4696 wrote to memory of 1844 4696 C1619D951B039CE9CB600815E8B14B26.exe 95 PID 1844 wrote to memory of 2624 1844 cmd.exe 97 PID 1844 wrote to memory of 2624 1844 cmd.exe 97 PID 1844 wrote to memory of 2624 1844 cmd.exe 97 PID 4696 wrote to memory of 4168 4696 C1619D951B039CE9CB600815E8B14B26.exe 99 PID 4696 wrote to memory of 4168 4696 C1619D951B039CE9CB600815E8B14B26.exe 99 PID 4696 wrote to memory of 4168 4696 C1619D951B039CE9CB600815E8B14B26.exe 99 PID 4696 wrote to memory of 4168 4696 C1619D951B039CE9CB600815E8B14B26.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\C1619D951B039CE9CB600815E8B14B26.exe"C:\Users\Admin\AppData\Local\Temp\C1619D951B039CE9CB600815E8B14B26.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2968
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2624
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4308,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:81⤵PID:1692